CVE-2025-46805: 
Linux Debian vulnerability analysis and mitigation

Screen version 5.0.0 and older version 4 releases contain a time-of-check/time-of-use (TOCTOU) race condition vulnerability when installed setuid-root. The vulnerability was discovered in May 2025 and affects the signal handling functionality in Screen, specifically in socket.c where signals are sent to user-supplied PIDs in setuid-root context (MITRE CVE, OpenWall).

The vulnerability exists in the CheckPid() function which drops privileges to the real user ID and tests whether the kernel allows sending a signal to the target PID using these credentials. However, the actual signal is sent later via Kill(), potentially using full root privileges. This creates a race condition where the PID that was previously checked could have been replaced by a different, privileged process. The issue resulted from an incomplete fix for CVE-2023-24626. The vulnerability has been assigned a CVSS v4.0 Base Score of 5.7 (Medium) according to SUSE's assessment (NVD Entry, SUSE Bugzilla).

The vulnerability allows sending SIGCONT and SIGHUP signals to privileged processes through a race condition. The primary impact is limited to local denial of service or minor integrity violations. It might also be possible to trick the privileged Screen daemon process into sending signals to itself, since a process is always allowed to send signals to itself (OpenWall).

The issue can be addressed by sending the actual signal with real UID privileges, just like CheckPid() does. A patch has been provided that implements this fix. Additionally, it is recommended not to install Screen with setuid-root privileges at all, as this significantly reduces the attack surface (OpenWall).

The vulnerability was discovered during a comprehensive security audit by the SUSE Security Team. The disclosure process faced some challenges with upstream coordination, taking longer than initially expected. The security community has emphasized the importance of proper privilege handling in setuid-root binaries (OpenWall).